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Amendments to the Claims 

1 . (Original) A method for prioritizing event datum received from a 
plurality of asynchronous telemetric streams within a system, the method 

35 comprising: 

receiving an event from one of the streams; 

determining whether a value of the event is less than a previously 
recorded minimum value for the stream, and if the value of the event is less than 
the previously recorded minimum value, updating the recorded minimum value to 
40 the value of the event; 

determining whether the value of the event is greater than a previously 
recorded maximum value for the stream, and if the value of the event is greater 
than the previously recorded, updating the recorded maximum value to the value 
of the event; 

45 generating a normalized event value based upon the value of the event, 

the recorded minimum value, and the recorded maximum value; determining a 
system threat level as a percentage of the streams that exhibit an alarm state; 
calculating a normalized rate of change of the stream; 
calculating a first exponential average based upon the determined threat 
50 level and a threat levei previously stored in a first table providing a correlation 

between system threat levels and normalized event values; 

calculating a second exponential average based upon the determined 
threat level and a threat level previously stored in a second table providing a 
correlation between system threat levels and normalized stream rates of change; 
55 and 

calculating a priority of the stream based upon a predetermined 
relationship between the first exponential average, the second exponential 
average, and an alarm status indicator associated with the stream. 

2. (Original) The method of claim 1 , wherein 
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60 the first exponential average comprises a number in a range from O to 

100, the second exponential average comprises a number in a range from O to 
100, and the alarm status indicator comprises either 1 or 0; and 

calculating a priority of the stream comprises dividing the sum of the first 
exponential average and second exponential average by 4 and adding to a 

65 resulting value a product of the alarm status indicator and 50. 

3. (Original) The method of claim 1 , wherein the predetermined 
relationship between the first exponential average, the second exponential 
average, and the alarm status indicator provides for predetermined weightings of 
the first exponential average, the second exponential average, and the alarm 

70 status indicator. 

4. (Original) A method for prioritizing event datum received from a 
plurality of streams within a system, the method comprising: 

receiving an event value from a stream; 

generating a normalized event value based upon the received event 

75 value; 

calculating a normalized rate of change of the stream; 

determining a system threat level based upon a number of alarm status 
indications associated with the plurality of streams; 

calculating a first exponential average based upon the determined threat 
80 level and a threat level previously stored in a first table providing a correlation 

between system threat levels and normalized event values; 

calculating a second exponential average based upon the determined 
threat level and a threat level previously stored in a second table providing a 
correlation between system threat levels and normalized stream rates of change; 
85 and 

calculating a priority of the stream based upon a predetermined 

relationship between the first exponential average, the second exponential 

average, and an alarm status indicator associated with the stream. 
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5. (Original) A method for prioritizing event datum received from a 
90 plurality of streams within a system, the method comprising: 

receiving an event from one of the streams; determining a current state of 
system health; 

generating a current normalized event value and a current normalized 
stream rate of change value; and 
95 defining a priority for the stream based upon a predetermined relationship 

between the current state of system health, the current normalized event value, 
the current normalized stream rate of change value, previously stored normalized 
event values, previously stored stream rate of change values, and an alarm 
status indicator associated with the stream. 

100 6. (Original) The method of claim 5 wherein defining a priority further 

comprises: 

calculating a first exponential average based upon the current state of 
system health and a state of system health previously stored in a first table 
providing a correlation between system health and normalized event values; 
105 calculating a second exponential average based upon the current state of 

system health and a state of system health previously stored in a second table 
providing a correlation between system threat levels and normalized stream rates 
of change; and 

calculating a priority of the stream based upon a predetermined 
1 10 relationship between the first exponential average, the second exponential 

average, and the alarm status indicator associated with the stream. 

7. (Original) The method of claim 6, wherein 

the first exponential average comprises a number in a range from 0 to 

100, the second exponential average comprises a number in a range from 0 to 
115 100, and the alarm status indicator comprises either 1 or 0; and 

the calculating a priority of the stream comprises dividing the sum of the 

first exponential average and second exponential average by 4 and adding to a 

resulting value a product of the alarm status indicator and 50. 
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8. (Original) A computer program product for use in an event 

120 monitoring system, the computer program product comprising instructions that, 

when executed by a processor, cause the processor to: 

get an event from a stream selected from a plurality of streams; 
determine a current normalized event value and a current normalized rate . 
of change of event values for the stream; 
125 determine a level of current system health; 

evaluate a historic relationship between levels of system health, 
normalized event values for the stream, and normalized rates of change of event 
values for the stream; 

predict an effect upon system health that is likely to occur based upon the 
130 determined current normalized event value for the stream, the determined 

current normalized rate of change of event values for the stream, and the 
evaluated historic relationship; and determine a priority for the event based upon 
the predicted effect. 

9. (Cancelled) 
135 10. (Cancelled) 

11. (Cancelled) 

12. (Previously Amended) An event prioritization system for using in 
monitoring a plurality of data streams generated by a communications network, 
the event prioritization system comprising: 

140 a plurality of agent applications for monitoring selected parameters 

descriptive of a functionality of the communications network, each such agent 
generating an independent data stream and delivering the generated stream to a 
common nexus r and a processor associated with the common nexus, the 
processor being configured to execute a historic learning algorithm to assign 

145 priorities to event datum received from the data streams generated by the 

agents, wherein the processor executes a set of programming instructions for 
causing the processor to 
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receive an event from one of the streams; 

determine whether a value of the event is less than a previously recorded 
150 minimum value for the stream, and if the value of the event is less than the 

previously recorded minimum value, update the recorded minimum value to the 
value of the event; 

determine whether the value of the event is greater than a previously 
recorded maximum value for the stream, and if the value of the event is greater 
155 than the previously recorded, update the recorded minimum value to the value of 

the event; 

generate a normalized event value based upon the value of the event, the 
recorded minimum value, and the recorded maximum value; 

determine a system threat level as a percentage of the streams that 
160 exhibit an alarm state; 

calculate a normalized rate of change of the stream; 
calculate a first exponential average based upon the determined threat 
level and a threat level previously stored in a first table providing a correlation 
between system threat levels and normalized event values; 
165 calculate a second exponential average based upon the determined threat 

level and a threat level previously stored in a second table providing a correlation 
between system threat levels and normalized stream rates of change; and 

calculate a priority of the stream based upon a predetermined relationship 
between the first exponential average, the second exponential average, and an 
170 alarm status indicator associated with the stream. 
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